New Office Bulletin Fixes 6 Critical Flaws

Flaws allowing remote code execution in Microsoft Office and elevation of privilege in Windows were the source for two security bulletins posted by the software giant on Tuesday.

Microsoft had warned customers last week that the two bulletins would be coming.

The Office bulletin is the more serious of the two. Rated critical, bulletin MS06-012 actually includes fixes for six distinct critical flaws. Some of the vulnerabilities were privately reported, as Microsoft requests, while others had been made public. According to Microsoft, all the flaws involve malformed inputs and are fixed in a similar way.

The Windows bulletin, MS06-011, involves a publicly-disclosed vulnerability involving certain Windows services. The elevation of privileges flaw could allow an attacker to take complete control of an affected system. While the flaw is rated an "important" risk in Windows XP Service Pack 1 and a "moderate" risk in Windows Server 2003, it is non-existent in Windows XP SP2 and Windows Server 2003 SP1.